授权本机 SPIFFE 身份访问开发服务

infrastructure/openbao/terraform/auth-spire.tf

@@ -25,3 +25,28 @@ resource "vault_jwt_auth_backend_role" "spire_poc" {
   token_ttl               = 300
   token_max_ttl           = 900
 }
+
+# Local development on the laptop. Keep the subject exact: possession of any
+# other identity in the trust domain must not grant interactive host access.
+resource "vault_jwt_auth_backend_role" "local_development" {
+  backend   = vault_jwt_auth_backend.spire.path
+  role_name = "local-development"
+  role_type = "jwt"
+
+  user_claim      = "sub"
+  bound_audiences = ["openbao"]
+  bound_claims = {
+    sub = "spiffe://ddupan.top/dev/panxiao81"
+  }
+
+  # local-development grants normal KV v2 read/write plus short-lived SSH
+  # certificate signing; spire-poc only permits lookup and revocation of the
+  # caller's own short-lived Bao token.
+  token_policies = [
+    vault_policy.local_development.name,
+    vault_policy.spire_poc.name,
+  ]
+  token_no_default_policy = true
+  token_ttl               = 300
+  token_max_ttl           = 900
+}

infrastructure/openbao/terraform/policies.tf

@@ -14,6 +14,11 @@ resource "vault_policy" "ai_agent_ssh" {
   policy = file("${path.module}/policies/ai-agent-ssh.hcl")
 }
 
+resource "vault_policy" "local_development" {
+  name   = "local-development"
+  policy = file("${path.module}/policies/local-development.hcl")
+}
+
 resource "vault_policy" "spire_poc" {
   name   = "spire-poc"
   policy = file("${path.module}/policies/spire-poc.hcl")

infrastructure/openbao/terraform/policies/local-development.hcl

@@ -0,0 +1,19 @@
+# Local development identity. This policy deliberately permits normal KV v2
+# reads and writes but excludes soft-delete, metadata deletion, permanent
+# version destruction, auth administration, and privileged operations.
+path "kv/data/*" {
+  capabilities = ["create", "read", "update"]
+}
+
+path "kv/metadata" {
+  capabilities = ["read", "list"]
+}
+
+path "kv/metadata/*" {
+  capabilities = ["read", "list"]
+}
+
+# Sign disposable SSH public keys for short-lived development access.
+path "ssh-client-signer/sign/ai-agent" {
+  capabilities = ["create", "update"]
+}